HotLoad-Driver

Hot Load Your Driver Using C++ this project was Bsides Augusta for the RAT talk. Slides can be seen bellow and are extremely helpful for understanding the execution flow. These two methods have separate projects. Demo / Slides:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: imxsckey – fixed memory corruption upon unloading. It should be labeled as “priv”, but we accidentally passed “&priv”, which is an address in the stack. This can lead to memory corruption when the imxsckeyaction function i...

swsim

swSIM Project needs to be cloned recursively. Downloading the ZIP is not enough. swSIM is an all-software SIM card. It's the first publicly available to the best of my knowledge SIM card simulator which does not rely on any SIM hardware to work. Scope A software-only SIM card simulator. It does N...

swsim

swSIM 项目必须 通过递归方式克隆。仅下载 ZIP 不够。 swSIM 是一个纯软件的 SIM 卡。据我所知，它是首个公开可用的、不依赖任何 SIM 硬件即可工作的 SIM 卡模拟器。 适用范围 纯软件的 SIM 卡模拟器。 工作不依赖 任何硬件。 可通过 swICC PC/SC 读卡器 以 PC/SC 方式连接到 PC。 PC/SC 接口使其能够连接到任何 带有 SIM 卡槽的手机。我们使用了运行 cardem 固件 的 SIMtrace 2 设备，但任何其他能够在手机与手机之间转发消息的工具也同样适用。 安装 编译项目需要 make 和 gcc。没有额外的运行时依赖。 1. su...

hsm

zhsm A Hardware Security Module HSM library for Zig providing PC/SC access to PIV , CAC , and YubiKey tokens. Status Aspect| Info ---|--- API Stability| Development Zig Version| 0.16.0 Platforms| Linux, macOS, Windows License| MIT Features PIV Support NIST SP 800-73-4 Certificate retrieval slots...

PT-2026-90251

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdma rn unregister before rdma destroy id svc rdma free caches rdma-sc cm id-device before teardown, then calls rdma destroy idsc cm id which frees the cm id. rpcrdma rn unregister follows, but between those t...

EUVD-2026-70975

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

SUSE CVE-2026-72072

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

EUVD-2026-66446

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

UBUNTU-CVE-2026-80531

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

CVE-2026-80531

CVE-2026-80531 is a Use-After-Free (UAF) in the XFS filesystem component of the Linux kernel, specifically in xrep_tempfile_create on the sc->tempip pointer. The UAF occurs when temporary file creation code fails after sc->tempip has been assigned, leading to a use of freed memory. Red Hat ...

PT-2026-82147

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the xfs component. This occurs within the xrep tempfile create function if the tempfile creation process fails after the sc-tempip variable has been...

Astra Linux – Vulnerability in opensc

Before version 0.20.0-rc1, OpenSC had a buffer overflow vulnerability related to accessing an ASN.1 bitstring within decodebitstring in the libopensc/asn1.c file...

Astra Linux – Vulnerability in opensc

The contextcreate function in ctx.c, within libopensc in OpenSC 0.19.0, has a memory leak, as evidenced by a call from eidenv...

CVE-2026-72072

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

SUSE CVE-2026-67301

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

EUVD-2026-51857

FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When AsyncUpdate is enabled e.g., xfreerdp /async-update, updatemessagePolygonSC and updatemessagePolygonCB allocate a fresh points array but...

SUSE CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

CVE-2026-64519

The CVE-2026-64519 issue affects the Linux kernel NFSD layout state revocation. The root cause is in nfsd4_revoke_states(): SC_TYPE_LAYOUT path never sets sc_status before calling nfsd4_close_layout(), while find_one_sb_stid() skips stids with non-zero sc_status. This causes the retry loop to rep...